Is the APK Red Team Pipeline skill free?

Yes. The skill itself is free from elementalsouls/Claude-BugHunter. SkillProof publishes the install command and an independent test verdict at no cost.

What is the APK Red Team Pipeline SkillProof Score?

9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 4/5.

How do I install APK Red Team Pipeline?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use APK Red Team Pipeline with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

APK Red Team Pipeline

End-to-end Android APK acquisition, decompile, and secret-extraction pipeline for authorized red-team work.

by elementalsouls · elementalsouls/Claude-BugHunter

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 9.2/10
Tested: Jul 10, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 6ea9dc7

For an extraction-plan task it produced a real regex catalog for leaked keys (AWS, Firebase, GitHub, API tokens) and explicit anti-patterns like not trusting expired JWTs, well beyond a generic 4-step checklist.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 9/10
Docs & honesty 4/5

What APK Red Team Pipeline does

Automates the full mobile pentest chain for an Android target: Play Store/APKMirror/APKPure acquisition, jadx decompilation, a 60-pattern secret grep (AWS, Google, GitHub, Slack, Stripe, JWT, Firebase), pinned-cert and exported-component enumeration, and Frida/mitmproxy runtime instrumentation. Triggers when recon surfaces a mobile app catalogue, a directly hosted .apk file, or Android in a bug-bounty scope; explicitly excludes iOS and React Native/Flutter JS-bundle work.

How to install APK Red Team Pipeline

git clone https://github.com/elementalsouls/Claude-BugHunter
cd Claude-BugHunter
mkdir -p ~/.claude/skills
cp -r skills/apk-redteam-pipeline ~/.claude/skills/apk-redteam-pipeline

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger APK Red Team Pipeline

/apk-redteam-pipeline End-to-end Android APK acquisition, decompile, and secret-extraction pipeline for authorized red-team work.

It also activates on plain-language prompts like these:

Decompile this Android APK and grep it for hardcoded secrets
Pull the target app from the Play Store for our authorized pentest
Enumerate exported components and pinned certs in this APK

Frequently asked questions

Is the APK Red Team Pipeline skill free?: Yes. The skill itself is free from elementalsouls/Claude-BugHunter. SkillProof publishes the install command and an independent test verdict at no cost.
Does APK Red Team Pipeline work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 10, 2026. Verdict: Tested · Works. For an extraction-plan task it produced a real regex catalog for leaked keys (AWS, Firebase, GitHub, API tokens) and explicit anti-patterns like not trusting expired JWTs, well beyond a generic 4-step checklist.
What is the APK Red Team Pipeline SkillProof Score?: 9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 4/5.
How do I install APK Red Team Pipeline?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use APK Red Team Pipeline with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.